Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
03-02-2024 08:35
General
-
Target
2024-02-03_9be28af8e91f105c220ca92ee6a88177_cryptolocker.exe
-
Size
30KB
-
MD5
9be28af8e91f105c220ca92ee6a88177
-
SHA1
0f3f144310304ef3353fbe3d8dc7a5e48ad40f3b
-
SHA256
67c98b71b02c2063148469bb4078c2c605494005027d634926b3a0300d7badf2
-
SHA512
89a6347ea66089382555083f8ded3ddda195b8ad8a526ac8a052b63e80dbb1a08f2b8c6e6f53e47e91a9c610ca8541e8f1ea2bd863f8fd5948df2b6230e216ee
-
SSDEEP
768:q0ZziOWwULueOSdE8tOOtEvwDpjeWaJIOc+4tHU:q0zizzOSxMOtEvwDpj/arq0
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-03_9be28af8e91f105c220ca92ee6a88177_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-03_9be28af8e91f105c220ca92ee6a88177_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30KB
MD55f3f67fc56ecb742bf7b6b9e7112a358
SHA1fef5238a98227887baf64d4f9dde4b966612fdd7
SHA256d54e58abf708e6dce3e9c4cad36882df0cd028cf1acd6a9adc44c940f20c8474
SHA512744f1b1a6073f65fd589b44ea412b38eae3c4a53b7fdde9797f235dba786f35618e79dd2149025ec7d1b4b13d722313fd94ebc581a9fa04c06e715d630a5f45a
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB